High CVEs
New CVEs as they are published, with CVSS score, CISA KEV status, public exploits and the vendor's fix. Worth tracking, but only a small part of what Panop does: mapping what you expose to the internet, testing what an attacker can actually exploit, ranking it by business impact, and helping your team understand and fix it.
Feed at a glance
- Tracked
- 10425
- Critical
- 1916
- CISA KEV
- 79
- Public PoC
- 384
Most common types
- Broken Access Control 1290
- Privilege Escalation 1190
- Remote Code Execution 1111
- Authentication Bypass 835
- Denial of Service 799
Published per day, last 14 days
Source: public CVE records (NVD, CISA KEV) · last published 20 Oct 2026
High CVEs
Newest first · severity as published by the vendor or NVD · page 200 of 568
- 8.2 /10 HighCVE-2026-95105
danielberkompas cloak - Reliance on Obfuscation or Encryption without Integrity Checking
danielberkompas cloak from 0.1.0-pre onward contains a reliance on obfuscation or encryption of security-relevant inputs without integrity checking caused by use of AES-256 CTR mode encryption without MAC, letting attackers with write access to ciphertext modify decrypted plaintext via bit flipping, exploit requires write access to encrypted store.
- 7.1 /10 HighCVE-2026-94675 No auth
Fluent Forms Pro Add On Pack - Reflected XSS
Fluent Forms Pro Add On Pack <= 6.2.13 contains a reflected XSS caused by improper input sanitization, letting unauthenticated attackers execute scripts in users' browsers, exploit requires no authentication.
- 8.1 /10 HighCVE-2026-89430 Auth required
Gitea - Broken Access Control
Gitea contains a broken access control vulnerability caused by insufficient validation of push mirror remote addresses during synchronization, letting repository administrators force-push to internal or blocked Git services, exploit requires admin access to repository.
- 7.1 /10 HighCVE-2026-86684 PoC publicAuth required
Gitea - Broken Access Control
Gitea contains a broken access control vulnerability caused by improper permission checks in the push mirror API allowing repository administrators to push to local file system paths if the repository owner has permission, exploit requires repository administrator privileges.
- 8.2 /10 HighCVE-2026-86362 Auth required
Dell System Update - Elevation of Privileges
Dell System Update < 2.3.0.0 contains an improper access control vulnerability caused by flawed access restrictions, letting low privileged local attackers escalate privileges, exploit requires local access.
- 8.2 /10 HighCVE-2026-86361 Auth required
Dell System Update - Privilege Escalation
Dell System Update < 2.3.0.0 contains an incorrect permission assignment for critical resource, letting low privileged local attackers escalate privileges, exploit requires local access.
- 8.8 /10 HighCVE-2026-85523 Auth required
Felisify Information Technologies Industry and Trade Inc. SambaBox - OS Command Injection
Felisify Information Technologies Industry and Trade Inc. SambaBox < 5.4.1 contains an OS command injection caused by improper neutralization of special elements in OS commands, letting attackers execute arbitrary commands remotely, exploit requires crafted input.
- 7.0 /10 HighCVE-2026-84854 Auth required
WibuKey - Buffer Overflow
WibuKey driver for Windows < 6.72 contains a buffer overflow caused by insufficient validation of user input when calculating kernel buffer size, letting attackers cause system crash or modify adjacent kernel memory, exploit requires local access.
- 7.1 /10 HighCVE-2026-83550
postgres-exporter - Information Disclosure & Denial of Service
postgres-exporter contains an information disclosure and denial of service vulnerability caused by exposed debug endpoints via blank import of net/http/pprof on unauthenticated metrics listener, letting remote attackers within cluster network access sensitive data and cause service disruption, exploit requires network access within cluster.
- 7.5 /10 HighCVE-2026-82988 No auth
ViewSonic ViewBoard - Arbitrary File Download
ViewSonic ViewBoard contains an arbitrary file download vulnerability in the vCast APK delivery mechanism, letting remote unauthenticated attackers trigger unprivileged APK installation via a malicious APK URL.
- 8.1 /10 HighCVE-2026-82531 PoC publicNo auth
Smarty - Code Injection
Smarty < 4.5.8 and 5.x < 5.8.5 contain a code injection vulnerability caused by improper restoration of top-level nocache_hash during multi-component template inheritance, letting attackers execute arbitrary PHP code remotely, exploit requires crafted assigned data with forged SmartyNocache marker.
- 7.4 /10 HighCVE-2026-82162 No auth
Dell Command | Configure - Elevation of Privileges
Dell Command | Configure (DCC) < 5.2.3.35 contains an improper handling of mixed encoding vulnerability, letting unauthenticated remote attackers elevate privileges, exploit requires remote access.
- 7.1 /10 HighCVE-2026-79960 Auth required
Gitea - Broken Access Control
Gitea contains a broken access control vulnerability caused by incorrect attribution of repository owner when using deploy keys, letting attackers with writable deploy keys create protected tags and change repository visibility, exploit requires writable deploy key.
- 7.2 /10 HighCVE-2026-79811 Auth required
ClearPass Policy Manager - SQL Injection
ClearPass Policy Manager contains a sql injection caused by improper input sanitization in the API, letting remote authenticated attackers with admin privileges execute arbitrary database commands.
- 7.2 /10 HighCVE-2026-79810 Auth required
HPE Networking ClearPass Policy Manager - Remote Code Execution
HPE Networking ClearPass Policy Manager contains a remote code execution caused by vulnerabilities in the affected interface, letting authenticated remote attackers with high privileges execute arbitrary code on the operating system.